Audit of the Office of Medicaid (MassHealth) - Review of Continuity of Operations Plan

This is a state audit of MassHealth’s emergency planning, especially whether it could keep key Medicaid systems running if something went wrong.

“OSA has conducted a performance audit of MassHealth’s continuity of operations plan (COOP) and disaster recovery plan (DRP) for its Medicaid Management Information System (MMIS) for the period January 1, 2020 through June 30, 2021.”

The auditor checked whether MassHealth followed state rules for emergency planning and disaster recovery for its Medicaid computer system.

“The purpose of this audit was to determine whether MassHealth complied with Executive Order 490 and Sections 6.1 and 6.2 of the Executive Office of Technology Services and Security’s Business Continuity and Disaster Recovery Standard IS.005.”

If MassHealth’s systems go down for a long time, people who rely on MassHealth could have trouble getting access to benefits.

“As a result, MassHealth is vulnerable to a disruption of services that could negatively affect its members if its IT capabilities are inoperable for an extended period.”

If you or someone you know depends on MassHealth, this matters because emergency planning helps protect access to healthcare benefits during a crisis.

“MassHealth provides access to healthcare for approximately 1.8 million low- and moderate-income children, families, seniors, and people with disabilities annually.”

The audit found two main problems: MassHealth had not kept its continuity plan current or practiced it, and it had not kept or tested its disaster recovery plan each year.

“MassHealth did not annually update or test its DRP.”

MassHealth said it agreed with the recommendations and was working on updates, monitoring controls, written procedures, and moving disaster recovery to AWS.

“MassHealth agrees with the [Office of the State Auditor’s] recommendations listed above and has resumed its work to update the MassHealth COOP.”

This is significant because Medicaid is a major state program, serving many residents and making up a large part of the Massachusetts budget.

“Medicaid expenditures represented approximately 40% of the Commonwealth’s total fiscal year 2021 budget.”

A continuity of operations plan is a playbook for keeping essential work going for up to 30 days when an emergency affects offices, systems, staff, or operations.

“The . . . Continuity of Operations Plan (COOP) provides a framework to ensure continued operation of mission essential functions for up to 30 days when an internal or external emergency impacts [an] Agency’s facilities, systems, personnel, and/or operations.”